---
title: "Best Practices for CloudTrail and GuardDuty Setup"
slug: "best-practices-for-cloudtrail-and-guardduty-setup"
updated: 2026-09-09T16:09:40Z
published: 2026-09-09T16:09:40Z
canonical: "docs.redcanary.com/best-practices-for-cloudtrail-and-guardduty-setup"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Best Practices for CloudTrail and GuardDuty Setup

To ensure a successful [integration between Zscaler MDR and AWS](/doc/docs/integrate-amazon-web-services-with-red-canary), make sure you configure CloudTrail and GuardDuty (if used) as described below.

## CloudTrail Setup

For step-by-step instructions on how to set up CloudTrail, please refer to the following AWS documentation:

- Organization level: [Creating a trail for your organization in the console](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-an-organizational-trail-in-the-console.html)
- Account level: [Creating a trail with the CloudTrail console](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html)

Zscaler MDR requires the following CloudTrail configuration:

- Use the default folder structure that CloudTrail creates in S3. **Please do not add an optional prefix**.
- Configure your trail to log events for all regions.
- Configure your trail to log management events and read/write events. See [Management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html#logging-management-events).
- [*For organizational-level integrations*] Set up CloudTrail as an organizational trail to log all events for all AWS accounts in the organization. Zscaler MDR’s [status checks](/doc/docs/understanding-status-checks) will fail if CloudTrail is only configured for the management account and not member accounts. See [Creating a trail for an organization](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html).

## GuardDuty Setup

For step-by-step instructions on how to set up and configure GuardDuty to export findings, please refer to the following AWS documentation:

- [Enable Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html#guardduty_enable-gd)
- [Exporting generated GuardDuty findings to Amazon S3 buckets](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html)

Zscaler MDR requires the following GuardDuty configuration:

- Use the default folder structure that GuardDuty creates in S3. **Please do not add an optional prefix**.
- Don’t use GuardDuty suppression rules. See [Deleting suppression rules in GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/delete-suppression-rules-guardduty.html).
- [*Highly recommended*] Enable GuardDuty for all accounts that we’re monitoring. See [Managing GuardDuty accounts with AWS Organizations](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html).

## Additional Recommendations for Organization-Level Integrations

- Please review your Service Control Policies (SCPs) to check if any will prevent access. See [Service control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html).
- If you’re using Control Tower, please review your settings. You may need to [grant Zscaler MDR regional access](/doc/docs/integrate-aws-with-red-canary-and-control-tower).